Skip to content

Cross-Site Scripting in swagger-ui

moderate severity Published Sep 11, 2020 • Updated Sep 28, 2021

Package

npm swagger-ui (npm)

Affected versions

< 3.0.13

Patched versions

3.0.13

Description

Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 3.0.13 or later.

References

GHSA ID

GHSA-388g-jwpg-x6j4

CVSS Score

6.5 Moderate
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N